AWSCodePipeline_FullAccess

Summary

Provides full access to AWS CodePipeline via the AWS Management Console.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN

arn:aws:iam::aws:policy/AWSCodePipeline_FullAccessCopy ARN

Default version

v3

Created

2020-08-03

Last edited

2024-03-14

Services

chatbot, cloudformation, cloudtrail, codebuild, codecommit, codedeploy, codepipeline, codestar-notifications, ec2, ecr, ecs, elasticbeanstalk, events, iam, lambda, opsworks, s3, sns, states

Control-plane actions (107)

By access level: 34 List, 2 Permissions management, 25 Read, 2 Tagging, 44 Write.

Data-plane actions (3)

By access level: 1 List, 2 Read.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants at least 80% of the write and permissions-management actions of: codepipeline (27 of 27).
• Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Related policies

Same service

• AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicy
• AWSCodeBuildAdminAccess
• AWSCodeBuildDeveloperAccess
• AWSCodeCommitFullAccess
• AWSCodeCommitPowerUser
• AWSCodeDeployDeployerAccess
• AWSCodeDeployFullAccess
• AWSCodeDeployReadOnlyAccess

Same domain

• AIDevOpsAgentFullAccess
• AIDevOpsAgentReadOnlyAccess
• AIDevOpsChannelAccessPolicy
• AIDevOpsConstellationAccessPolicy
• AIDevOpsOperatorAppAccessPolicy
• AmazonCodeCatalystFullAccess
• AmazonCodeCatalystReadOnlyAccess
• AmazonCodeGuruProfilerAgentAccess

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Statement": [
    {
      "Action": [
        "codepipeline:*",
        "cloudformation:DescribeStacks",
        "cloudformation:ListStacks",
        "cloudformation:ListChangeSets",
        "cloudtrail:DescribeTrails",
        "codebuild:BatchGetProjects",
        "codebuild:CreateProject",
        "codebuild:ListCuratedEnvironmentImages",
        "codebuild:ListProjects",
        "codecommit:ListBranches",
        "codecommit:GetReferences",
        "codecommit:ListRepositories",
        "codedeploy:BatchGetDeploymentGroups",
        "codedeploy:ListApplications",
        "codedeploy:ListDeploymentGroups",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "ecr:DescribeRepositories",
        "ecr:ListImages",
        "ecs:ListClusters",
        "ecs:ListServices",
        "elasticbeanstalk:DescribeApplications",
        "elasticbeanstalk:DescribeEnvironments",
        "iam:ListRoles",
        "iam:GetRole",
        "lambda:ListFunctions",
        "events:ListRules",
        "events:ListTargetsByRule",
        "events:DescribeRule",
        "opsworks:DescribeApps",
        "opsworks:DescribeLayers",
        "opsworks:DescribeStacks",
        "s3:ListAllMyBuckets",
        "sns:ListTopics",
        "codestar-notifications:ListNotificationRules",
        "codestar-notifications:ListTargets",
        "codestar-notifications:ListTagsforResource",
        "codestar-notifications:ListEventTypes",
        "states:ListStateMachines"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CodePipelineAuthoringAccess"
    },
    {
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketPolicy",
        "s3:GetBucketVersioning",
        "s3:GetObjectVersion",
        "s3:CreateBucket",
        "s3:PutBucketPolicy"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3::*:codepipeline-*",
      "Sid": "CodePipelineArtifactsReadWriteAccess"
    },
    {
      "Action": [
        "cloudtrail:PutEventSelectors",
        "cloudtrail:CreateTrail",
        "cloudtrail:GetEventSelectors",
        "cloudtrail:StartLogging"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:cloudtrail:*:*:trail/codepipeline-source-trail",
      "Sid": "CodePipelineSourceTrailReadWriteAccess"
    },
    {
      "Action": [
        "iam:PassRole"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:iam::*:role/service-role/cwe-role-*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": [
            "events.amazonaws.com"
          ]
        }
      },
      "Sid": "EventsIAMPassRole"
    },
    {
      "Action": [
        "iam:PassRole"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": [
            "codepipeline.amazonaws.com"
          ]
        }
      },
      "Sid": "CodePipelineIAMPassRole"
    },
    {
      "Action": [
        "events:PutRule",
        "events:PutTargets",
        "events:DeleteRule",
        "events:DisableRule",
        "events:RemoveTargets"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:events:*:*:rule/codepipeline-*"
      ],
      "Sid": "CodePipelineEventsReadWriteAccess"
    },
    {
      "Sid": "CodeStarNotificationsReadWriteAccess",
      "Effect": "Allow",
      "Action": [
        "codestar-notifications:CreateNotificationRule",
        "codestar-notifications:DescribeNotificationRule",
        "codestar-notifications:UpdateNotificationRule",
        "codestar-notifications:DeleteNotificationRule",
        "codestar-notifications:Subscribe",
        "codestar-notifications:Unsubscribe"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "codestar-notifications:NotificationsForResource": "arn:aws:codepipeline:*"
        }
      }
    },
    {
      "Sid": "CodeStarNotificationsSNSTopicCreateAccess",
      "Effect": "Allow",
      "Action": [
        "sns:CreateTopic",
        "sns:SetTopicAttributes"
      ],
      "Resource": "arn:aws:sns:*:*:codestar-notifications*"
    },
    {
      "Sid": "CodeStarNotificationsChatbotAccess",
      "Effect": "Allow",
      "Action": [
        "chatbot:DescribeSlackChannelConfigurations",
        "chatbot:ListMicrosoftTeamsChannelConfigurations"
      ],
      "Resource": "*"
    }
  ],
  "Version": "2012-10-17"
}

Version history

Current version v3, edited by AWS on 2024-03-14. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess

resource "aws_iam_role_policy_attachment" "awscodepipeline_fullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSCodePipeline_FullAccess"),
);

Sources

Pending editorial review. No editorial sources are listed yet.

• Official AWS reference for AWSCodePipeline_FullAccess
• Report a data issue